Apple Adds 'BlastDoor' To Secure iOS From Zero-Click Attacks

wiredmikey shares a report from SecurityWeek.com: Apple has quietly added several anti-exploit mitigations into iOS in what appears to be a specific response to zero-click iMessage attacks observed in the wild. The new mitigations were discovered by Samuel Grob, a Google Project Zero security researcher, [with the first big addition being] a new, tightly sandboxed "BlastDoor" service that is now responsible for the parsing of untrusted data in iMessages.

With iOS 14, Grob discovered that Apple shipped a significant refactoring of iMessage processing, and made all four parts of an attack much harder to succeed. Apple added logic into iOS 14 to specifically detect [shared cache region] attacks and new techniques to limit an attacker's ability to retry exploits or brute force Address Space Layout Randomization (ASLR). "Overall, these changes are probably very close to the best that could've been done given the need for backwards compatibility, and they should have a significant impact on the security of iMessage and the platform as a whole," the Google researcher added.

Re:

[awwshit]

All software has bugs. I don't think either Google or Apple makes more perfect software than the other. I do know that Apple does not have the same advertising motive that Google does, Apple has less reason to capture and catalog my data.

Re:

[saloomy]

From my understanding, Apple's walled garden means (almost?) all software is internally reviewed before its able to land on a device. With Google, there are side-loaded apps, and sometimes the OEMs and carriers load their own software, which Google does not always vet. Google also (to your point) vets with different criteria. Apple blocks apps from sucking up user info unnecessarily. Google asks how much that info is worth.

Re:Security

[Flytrap]

I think that you are missing the point...

The iPhone is more secure because of the tight control that Apple has over security updates. Within a week or so, the vast majority of active iPhones will have this update (I upgraded to iOS14.4 on all my devices already).

But just because Apple has this tight control (walled garden) does not make iPhone or its software more or less bug-free than a Samsung or LG running Android. All software has bugs... some of those bugs can lead to security exploits and system vulnerabilities.

Apple is not necessarily more responsive or faster as addressing these flaws than Google (they certainly are faster than Samsung and LG)... but when they are addressed, the rollout is more comprehensive, which makes the entire ecosystem a lot more secure because attack vectors that might exploit unpatched devices in the Android world find it much harder to find these kind of gaps in the iOS ecosystem.

Re:

[ctilsie242]

Depends on how one defines "secure". Android uses Linux users and groups, as well as SELinux to keep apps from getting out of their areas. Android also uses both loopback mounted filesystems and encrypting /data with dm-crypt for its data at rest protection. With Android, you can have a boot PIN or password separate from your screen one, to ensure that a brute force attack is infeasible, especially with newer phones with TPMs that will cut things off and drop their stored keys after 30 or so attempts.

iOS

Re:

[Canberra1]

Complete garbage comment. See https://9to5mac.com/2021/01/14... [9to5mac.com] Apple has 1 billion phones in use, and they can't find the money to really fix what John Hopkins reports. You do NOT parse untrusted data- you parse ALL of it, with a clamp on message lengh, and xor the buffers right after. You stop parsing as soon as known limits are exceeded. All the forensic companies employ modem chip specialists. There is a good bet parsing everything equally would break law enforcement and side load holes. Now that App

Re:

[angel'o'sphere]

All software has bugs...
That is wrong.

Re:

[ArchieBunker]

Buy a midrange Android phone. How many OS updates will you receive? Meanwhile iPhone 6 devices are still getting updates.

Re: Security

[SleepingEye]

Did you just seriously compare a mid-range phone with a phone that costs two to four times a much... and expect it to be in the same ballpark? I mean, i could buy 3 midrange phones spread out over 6 years and keep up with updates with what it costs an i user

Re:

[cmseagle]

What do you consider "mid-range"? I can buy a $400 iPhone SE and it expect it to receive security updates for 5-6 years.

backward compatibility?

[backslashdot]

F that. Just put a limit on the character set and don't automatically parse anything other than substituting emojis. Is that fricking hard?

Re:

[saloomy]

You can send binary objects (files, stickers, etc) through iMessage. So... yeah, kinda is... I would throw it into BASE64 with a type tag surrounding the BLOB. Yes, yes yes, it will take up much more space. But really, our networks and devices are getting to the point where they can handle attachments much like email can....

Stupid is as Stupid Does

[Retired ICS]

If they knew the difference between CODE and DATA then there would have been no problem whatsoever. Clearly they have been following along in the Microsoft tradition of EXECUTING DATA -- a course of action which has always, without fail, led to disastrous consequences.

Yet another example of the little kiddies being hoisted by their own petards.

What about iOS v12?

[antdude]

Did iOS v12.5.1 fix it?

Moot point if vendors don't patch older devices?

[schwit1]

My Nexus6 hasn't seen an official OS update in years. It still does everything I need it to do.